Shorewall users - Nov 2003 - URGENT: Network Problem!!

Guys,

I''ve got a major prob on my LAN. I''ve just added a new box -
my
Playstation 2 (hence the urgency ;p). Its configured correctly as
192.168.0.4. It can ping all the other boxes on the LAN but nothing on
the www (via name or IP). It''s setup to use 192.168.0.1 as its default
gateway (my RH9 box with a PCI ADSL connection)

All other boxes on the internal network can get external connections.
Shorewall is installed on the gateway but its setup to allow any
outbound traffic. I tested for a prob on that IP by swapping the PS2''s
IP to one of the other ones that work on the LAN - same.

I tried all the obvious stuff - cabling, port on the switch, restarting
shorewall, network service etc. I even decided to lose the uptime on my
gateway to make sure - reboot did nothing. 

Maybe a dead PS2 NIC? Nope - I stuck my laptop on the LAN and it cant
get external access either.

The only thing left that I can think of is MAC address blacklisting and
I checked /etc/shorewall/maclist and blacklist and nothing and I don''t
think it''s likely that BOTH the PS2 and laptop''s mac addresses
are
banned.

Nothing in shorewall''s logs, so I tried sniffing the network with
tethereal from the gateway - the only mention of the IP is shown below.
Apart from the pings. I''ve no idea what it is - any takers?

from tethereal dump...

[root@potchin root]# less dump.txt | grep 192.168.0.4
  1.097327 3com_99:f8:35 -> Broadcast    ARP Who has 193.168.0.1?  Tell
192.168.0.4
  2.480374 3com_99:f8:35 -> Broadcast    ARP Who has 193.168.0.1?  Tell
192.168.0.4
  3.481888 3com_99:f8:35 -> Broadcast    ARP Who has 193.168.0.1?  Tell
192.168.0.4
  4.483369 3com_99:f8:35 -> Broadcast    ARP Who has 193.168.0.1?  Tell
192.168.0.4
  7.201238  192.168.0.4 -> 192.168.0.1  ICMP Echo (ping) request
  7.201479  192.168.0.1 -> 192.168.0.4  ICMP Echo (ping) reply
  8.205004  192.168.0.4 -> 192.168.0.1  ICMP Echo (ping) request
  8.205235  192.168.0.1 -> 192.168.0.4  ICMP Echo (ping) reply
  9.206541  192.168.0.4 -> 192.168.0.1  ICMP Echo (ping) request
  9.206802  192.168.0.1 -> 192.168.0.4  ICMP Echo (ping) reply
 10.207961  192.168.0.4 -> 192.168.0.1  ICMP Echo (ping) request
 10.208232  192.168.0.1 -> 192.168.0.4  ICMP Echo (ping) reply
 12.196537 CompaqCo_52:4f:15 -> 3com_99:f8:35 ARP Who has 192.168.0.4? 
Tell 192.168.0.1
 12.196751 3com_99:f8:35 -> CompaqCo_52:4f:15 ARP 192.168.0.4 is at
00:50:da:99:f8:35


Any suggestions welcome - I''m totally stumped! or have I missed
something blatantly obvious?!

Fingers crossed  ><

Jeff

On 19 Nov 2003, Jeff wrote:
> 
> The only thing left that I can think of is MAC address blacklisting and
> I checked /etc/shorewall/maclist and blacklist and nothing and I
don''t
> think it''s likely that BOTH the PS2 and laptop''s mac
addresses are
> banned.
> 
If you have ''maclist'' specfied on your internal interface and 
MACLIST_DISPOSITION=REJECT (or empty) then you *must* list the MAC address 
of each device that uses that interface.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net